kubernetes - 使用 terraform 在 k8s 集群中授予 RBAC 角色

Question

我想将 RBAC 规则分配给一个用户，该用户可以访问除 'create' 和 'delete' 动词之外的所有资源 'namespace' 使用 Terraform 的资源。

目前我们有如下规定:

rule {
    api_groups = ["*"]
    resources  = ["*"]
    verbs      = ["*"]
  }

Answer 1

我们可以在 Role and ClusterRole documentation 中找到，权限(规则)纯粹是附加的——没有“拒绝”规则:

Role and ClusterRoleAn RBAC Role or ClusterRole contains rules that represent a set of permissions. Permissions are purely additive (there are no "deny" rules).

可以找到可能的动词列表here :

您需要提供应应用于规则中包含的资源的所有动词。
而不是:

verbs      = ["*"]

提供所需的动词，例如:

verbs      = ["get", "list", "patch", "update", "watch"]

例如，我创建了一个example-role Role 和一个example_role_binding RoleBinding.
example_role_binding RoleBinding 将 example-role Role 中定义的权限授予用户 john.
注意:有关使用以下资源的详细信息，请参阅 kubernetes_role和 kubernetes_role_binding资源文档。

resource "kubernetes_role" "example_role" {
  metadata {
    name      = "example-role"
    namespace = "default"
  }

  rule {
    api_groups = ["*"]
    resources  = ["*"]
    verbs      = ["get", "list", "patch", "update", "watch"]
  }
}

resource "kubernetes_role_binding" "example_role_binding" {
  metadata {
    name      = "example_role_binding"
    namespace = "default"
  }
  role_ref {
    api_group = "rbac.authorization.k8s.io"
    kind      = "Role"
    name      = "example-role"
  }

  subject {
    kind      = "User"
    name      = "john"
    api_group = "rbac.authorization.k8s.io"
  }
}

此外，我还创建了 test_user.sh Bash 脚本来快速检查它是否按预期工作:
注意:您可能需要修改变量namespace、resources 和user 以满足您的需要。

$ cat test_user.sh
#!/bin/bash

namespace=default
resources="pods deployments"
user=john

echo "=== NAMESPACE: ${namespace} ==="
for verb in create delete get list patch update watch; do
    echo "-- ${verb} --"
    for resource in ${resources}; do
        echo -n "${resource}: "
        kubectl auth can-i ${verb} ${resource} -n ${namespace} --as=${user}
    done
done

$ ./test_user.sh
=== NAMESPACE: default ===
-- create --
pods: no
deployments: no
-- delete --
pods: no
deployments: no
-- get --
pods: yes
deployments: yes
-- list --
pods: yes
deployments: yes
...